Skip to main content

axios CVE-2026-67312

| EUVDEUVD-2026-51830 MEDIUM
Uncontrolled Resource Consumption (CWE-400)
2026-08-01 VulnCheck GHSA-4ww2-rjh2-xpv9
Denial Of Service Axios
6.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.7 LOW

AC:H captures the required attack precondition (FormData with JSON serialisation and attacker-controlled field names); availability impact is Low as crashes are catchable.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Source Code Evidence Fetched
Aug 01, 2026 - 13:40 vuln.today
Analysis Generated
Aug 01, 2026 - 13:40 vuln.today
Patch available
Aug 01, 2026 - 13:01 EUVD
CVE Published
Aug 01, 2026 - 12:22 cve.org
MEDIUM 6.3

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 39 npm packages depend on axios (18 direct, 21 indirect)

Ecosystem-wide dependent count for version 0.28.0.

DescriptionCVE.org

axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and causing denial of service for that request, or process termination in applications without appropriate error handling.

AnalysisAI

Uncontrolled recursion in axios's formDataToJSON helper allows remote, unauthenticated attackers to exhaust the JavaScript call stack and deny service to affected Node.js applications. axios versions 0.28.0 through 0.32.x and 1.0.0 through 1.17.x are affected wherever attacker-controlled FormData field names are deserialized with Content-Type: application/json, causing a RangeError that kills the request or terminates the process. No public exploit has been identified at time of analysis, but the GHSA advisory discloses sufficient technical detail - including the exact vulnerable function and the attack payload pattern - for independent reproduction; fixed releases 0.33.0 and 1.18.0 are available.

Technical ContextAI

axios is among the most widely deployed HTTP client libraries in the JavaScript ecosystem, available on npm (cpe:2.3:a:axios:axios). The vulnerable code lives in lib/helpers/formDataToJSON.js, introduced in version 0.28.0. The function parsePropPath() tokenises a FormData field name like a[x][x][x] into an array of path segments, then buildPath() recurses one call per segment to reconstruct a nested object - with no depth guard. This violates CWE-400 (Uncontrolled Resource Consumption): an adversary supplies a field name with thousands of bracket-delimited segments, forcing thousands of recursive stack frames until the JavaScript engine throws RangeError: Maximum call stack size exceeded. The symmetric inverse helper toFormData already enforces a maxDepth guard and raises AxiosError ERR_FORM_DATA_DEPTH_EXCEEDED, but this protection was never applied to formDataToJSON. The attack surface activates only when axios serialises FormData with Content-Type: application/json, either via direct calls to axios.formToJSON() or via the default transformRequest pipeline when that content-type is set.

RemediationAI

The primary fix is upgrading axios to version 0.33.0 (for the 0.x line) or 1.18.0 (for the 1.x line), as documented in the GitHub Security Advisory GHSA-pmv8-rq9r-6j72 and implemented in upstream pull requests https://github.com/axios/axios/pull/11000 and https://github.com/axios/axios/pull/11001. These releases introduce a depth guard in buildPath() analogous to the existing maxDepth protection in toFormData. If an immediate upgrade is not feasible, the principal compensating control is to validate and reject FormData field names containing deeply nested bracket sequences before they reach axios - for example, stripping or refusing any key where the bracket-segment count exceeds a safe threshold (e.g., 20). A second workaround is to avoid setting Content-Type: application/json when submitting FormData, which prevents the vulnerable formDataToJSON code path from being invoked; however, this may change application behaviour if JSON serialisation of form data is intentional. Wrapping axios calls in try/catch with process.uncaughtException handlers prevents process termination but does not prevent per-request DoS. None of the workarounds are substitutes for upgrading.

More in Axios

View all
CVE-2026-42043 CRITICAL POC
10.0 Apr 24

NO_PROXY protection bypass in Axios HTTP client (versions 1.0.0-1.15.0 and ≤0.31.0) lets an attacker who controls a requ
CVE-2026-42044 CRITICAL POC
9.1 Apr 24

JSON response tampering in the Axios HTTP client (versions 1.0.0 up to but not including 1.15.2) lets an attacker who ca
CVE-2026-67320 HIGH POC
8.3 Aug 01

Prototype pollution via the Node.js HTTP adapter in axios allows an attacker who controls `Object.prototype.proxy` to si
CVE-2025-27152 HIGH POC
7.7 Mar 07

axios is a promise based HTTP client for the browser and node.js. Rated high severity (CVSS 7.7), this vulnerability is

CVE-2025-58754 HIGH POC
7.5 Sep 12

Axios is a promise based HTTP client for the browser and Node.js. Rated high severity (CVSS 7.5), this vulnerability is

CVE-2026-25639 HIGH POC
7.5 Feb 09

Axios versions up to 0.30.3 is affected by improper check for unusual or exceptional conditions (CVSS 7.5).
CVE-2024-39338 HIGH POC
7.5 Aug 12

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative
CVE-2021-3749 HIGH POC
7.5 Aug 31

axios is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is

CVE-2019-10742 HIGH POC
7.5 May 07

Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to acce
CVE-2026-42033 HIGH POC
7.4 Apr 24

Prototype pollution in Axios HTTP client versions before 1.15.1 and 0.31.1 enables silent interception and modification

CVE-2026-42039 MEDIUM POC
6.9 Apr 24

Denial of service in Axios HTTP client before versions 1.15.1 and 0.31.1 allows remote unauthenticated attackers to cras
CVE-2026-42041 MEDIUM POC
6.5 Apr 24

Prototype pollution in Axios library versions prior to 1.15.1 and 0.31.1 allows remote attackers to suppress HTTP error

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Not-Affected
SUSE Linux Enterprise Module for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected

Share

CVE-2026-67312 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy